@@ -, +, @@ Notice you get a valid JSON response (You may have add more ..%2f or remove them to get the correct path) Notice you can see the contents of the /etc/passwd file --- C4/Auth.pm | 4 ++++ 1 file changed, 4 insertions(+) --- a/C4/Auth.pm +++ a/C4/Auth.pm @@ -158,6 +158,10 @@ sub get_template_and_user { C4::Context->interface( $in->{type} ); + # Sanitize template path to avoid path traversal + $in->{template_name} =~ s|^/||; + $in->{template_name} =~ s|\.\.||g; + $in->{'authnotrequired'} ||= 0; my $template = C4::Templates::gettemplate( $in->{'template_name'}, --